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We propose the continuous-variable quantum key distribution protocol based on the Gaussian modulation 
of a single quadrature of the coherent states of light, which is aimed to provide simplified implementation 
compared to the symmetrically modulated Gaussian coherent-state protocols. The protocol waives the necessity 
in one of quadrature modulations and the corresponding channel transmittance estimation. The security of the 
protocol against collective attacks in a generally phase-sensitive Gaussian channels is analyzed and is shown 
achievable upon certain conditions. Robustness of the protocol to channel imperfections is compared to that 
of the symmetrical coherent-state protocol. The simplified unidimensional protocol is shown possible at a 
reasonable quantitative cost in terms of key rate and of tolerable channel excess noise. 
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I. INTRODUCTION 

Over the last three decades, quantum key distribution 
(QKD) Jll] has emerged as a way to ensure the security of a se¬ 
cret key through the very nature of quantum states distributed 
between trusted parties. Recent developments in this field are 
concerned with the continuous-variables (CV) coding of key 
bits, in particular, the Gaussian modulation of the field 

quadratures of squeezed iHHH and coherent states of light 
lUlUl^ . Coherent state protocols are more promising exper¬ 
imentally 10 [HB, and the main goal of the present pa¬ 
per is to propose their further simplification. In particular, all 
published coherent-state protocols suppose a symmetrical am¬ 
plitude and phase quadrature modulation [with the exception 
of the binary Zhao-Heid-Rigas-Liitkenhaus 2009 (ZHRL09) 
protocol lll^ However, an asymmetric protocol allows Alice 
to use one modulator (e.g. an amplitude modulator) instead 
of two. This would reduce the complexity and the cost of Al¬ 
ice’s apparatus. Furthermore, the amplitude modulator used 
in a symmetric CV QKD apparatus needs to have a strong 
extinction ratio, in order to avoid creating a ’’hole” in the cen¬ 
ter of the Gaussian probability distribution lIB . On the other 
hand, a simple single-quadrature amplitude modulation does 
not have this need, and the use of more standard (and cheaper) 
modulators becomes possible. 

Thus, in the present paper we propose the unidimen¬ 
sional (UD) CV QKD protocol based on the Gaussian single¬ 
quadrature modulation of coherent states of light. We show 
the security of the protocol in a general phase-sensitive chan¬ 
nel restricting eavesdropper only by the physicality con¬ 
straints and keeping to the pessimistic worst-case assump¬ 
tions. Then we compare the UD protocol to the standard 
coherent-state protocol and discuss the possible extensions. 
Our paper thus continues the tendency of technical simplifi- 


*Electronic address: usenko@optics.upol.cz 
^Electronic address: frederic.grosshans@u-psud.fr 


cation of the QKD protocols which was started in where 
the low cost and compact discrete variable QKD system was 
proposed. 

In Sec. im we present the UD CV QKD protocol, and we 
analyze its security in Sec. [Ill] We then look at its perfor¬ 
mance in the common case of symmetric quantum channels 
and compare it to the usual symmetric protocol in Sec. |IV] 


II. UNIDIMENSIONAL PROTOCOL 

The central idea of the protocol is to modulate a single 
quadrature of coherent states, in contrast to the usual coherent- 
state protocols, where two quadratures are simultaneously 
modulated. This should provide simplified implementation, 
at the price of slightly degraded performances, as we show 
below. The scheme of the protocol is given in Fig. [T] One 
of the trusted sides, Alice, produces coherent states, e.g. with 
a laser source. Then she applies modulation in one of the 
quadratures (denoted as x), using modulator M, and displaces 
each coherent state according to a random Gaussian variable 
with displacement variance Vm- With no loss of generality 
we further assume the modulated quadrature x to be the am¬ 
plitude quadrature. In this case the displacement can be per¬ 
formed by an intensity modulator. The mixture of the modu¬ 
lated states thus forms a “sausage” on a phase-space [see Fig. 
[T](a)]. Its thickness is the quadrature variance of a coherent 
state, i.e. 1 shot noise unit (SNU), and its length is s/Vm + 1 
SNU. The states are then sent to the remote trusted party 
Bob through a generally phase-sensitive channel with trans¬ 
mittance rjx, rjp, and excess noise tp in x, and p quadrature, 
respectively. Bob performs a homodyne measurement of the 
modulated quadrature, using a homodyne detector, measuring 
most of the time the ^quadrature, and sometimes measuring 
the ^quadrature. This basis switching should be performed of¬ 
ten enough to gather statistics on the properties of the channel 
in the p-quadrature. However, in the asymptotic limit of many 
repetitions studied here, these measurements can be a vanish¬ 
ing fraction of the total data set and have a negligible impact 
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FIG. 1; (Color online) Scheme of the UD coherent-state protocol. 
Alice prepares a coherent state using a laser source and then mod¬ 
ulates the state by displacing it along the modulated quadrature us¬ 
ing modulator M so that the modulation variance is Vm- The states 
travel through an untrusted generally phase-sensitive channel to a re¬ 
mote party Bob, who performs homodyne measurement of the mod¬ 
ulated quadrature, (a) Mixture of modulated coherent states on a 
phase space (assuming x quadrature was modulated), (b) Equiva¬ 
lent entanglement-based scheme using a two-mode squeezed vacuum 
source, mode A is measured by Alice using a homodyne detector, 
mode B is squeezed on the squeezer S and sent to the channel. 


on the key rate ll^ . After a sufficient number of runs, Al¬ 
ice and Bob analyze the security and extract a secret key from 
the x-quadrature data using a reverse-reconciliation procedure 

idEl. 

In the following section we estimate the security region of 
the UD protocol and compare it to the standard coherent-state 
based protocol. 


III. SECURITY OF THE PROTOCOL 


Let us study the protocol in detail and estimate its applica¬ 
bility. 


A. Computing the Key Rate from the Covariance Matrix 


In the case of collective attacks the lower bound on the key 
rate is given by the difference between classical (Shannon) 
mutual information, available to the trusted parties (A and B), 
and the upper bound on the information extractable from the 
state possessed by an eavesdropper (E) and conditioned by the 
measurement results of the reference side of the classical post 
processing algorithms, i.e., in the case of reverse reconcilia¬ 
tion the lower bound reads: 

K = Iab — Xbe, ( 1 ) 

where xbe = S{E) — S{E\xb) is the Holevo quantity 1^ . 
being the capacity of a bosonic channel between an eaves¬ 
dropper (E) and the reference side of the information rec¬ 
onciliation (B), quantified as the difference of von Neumann 
entropy S{E) of the state, available to an eavesdropper, and 
the entropy S{E\xb) of the eavesdropper state, conditioned 
by the measurement results of the remote trusted party B 
1 ^ . The positivity of the lower bound ([ T]i means that 
the post-pro cessing algorithms are able to distill the secure 
key 11^ 1^ . i.e., that the protocol is secure under given chan¬ 
nel conditions. In the cases where channel noise is present, 
the collective attack can be accessed through the assump¬ 
tion that the eavesdropper holds the purification of the state, 
shared between A and B, thus the entropies of the sub states 
of the generally pure state are equal: S{E) = S{AB) and 
S{E\xb) = S{A\xb)- The calculation of the von Neumann 
entropies, contributing to the Holevo quantity, is done, us¬ 
ing the covariance matrix formalism, explicitly describing the 
Gaussian states, through the symplectic eigenvalues Ai 2 and 
Acond of the respective covariance matrices xab prior to and 
1a\xb measurement so that 

( 2 ) 

where G(a;) = (a:+1) log(a; +1) — a; log a: BMl is the bosonic 
entropic function JH. 


The study of security of CV QKD protocols including fi¬ 
nite size effects ll^ 24 land coherent attacks is an ongoing 
research programllTi l8l |25 | - It^ . Very recently ll^ . Leverrier 
has shown for the first time the composable security against 
general attacks for a CV QKD coherent-state protocol. It was 
shown that for the symmetrically modulated coherent-state 
protocol, the optimal attacks are the Gaussian attacks and the 
corresponding secret key rate tends to the one obtained for 
Gaussian collective attacks ll29l - l^ for high number of pulses. 

We will compute the asymptotic key rate of our protocol 
against collective attacks. An approach similar to can 
likely be applied to extend this security to a general attack, 
but this work is kept for future research. 

The extremality of Gaussian states ll^ and subsequent 


130(1 allows one 


to use 


optimality of Gaussian attacks 
the powerful covariance matrix formalism to estimate the 
amounts of information leaking to a potential eavesdropper 
under given channel conditions. 


B. Which Covariance Matrices are Physical ? 


To analyze the security of the protocol we switch to the 
equivalent entanglement-based (EPR) scheme ll^ . which al¬ 
lows the explicit description of trusted modes and their cor¬ 
relations. Eor the UD protocol such a scheme can be built, 
by taking a two-mode squeezed vacuum state of variance V 
and squeezing one of its modes with the squeezing parameter 
— log v/U, resulting in the covariance matrix: 


7AS = 
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( 3 ) 

As stated above, the modulated quadrature is the intensity 
quadrature x. If Alice performs a homodyne measurement 
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on the mode A, then the coherent state is conditionally pre¬ 
pared and is effectively sent to the remote party Bob. The 
EPR-scheme is then equivalent to the Gaussian displacement 
of coherent states along the x quadrature with the variance 
Vm = — 1. As the states travel through the noisy and 

lossy channel, the covariance matrix is transformed according 
to the channel parameters. However, since there is no modula¬ 
tion in the p quadrature, the correlation, and, respectively, the 
channel transmittance in p cannot be estimated. The remote 
party can therefore only measure the variance of the channel 
output in p. Thus, generally, the covariance matrix after the 
channel in terms of the modulation variance Vm has the form: 


and, thus, depends on the unknown correlation parameter Cp. 
However, this unknown parameter is bounded by the require¬ 
ment of the physicality of the state, which is given by the 
Heisenberg uncertainty principle, in terms of the covariance 
matrices being 

i'ab + > 0, (9) 

where fl is the symplectic form 

H = 0a;, (10) 


Iab — 

V1 + Vm 0 + 0 ■ 

0 vi + ^M 0 Cp 

\/pVm Vm)'^ 0 1 -f Pa:(hM + Cx) 0 

0 Cp 0 Vp^ 

(4) 


This equation imposes physical constraints on the possible 
values of Cp. Such constraint in the general case of noise 
present in both quadratures is given by the parabolic equation 
on the {Vj^,Cp} plane: 

{Cp - Cof < , (1 - v.Vo^){Vp^ - Vo^) ( 11 ) 

(1 + Vm j 2 


where rja: and are, respectively, the channel transmittance 
and excess noise, estimated by the trusted parties through the 
measurement of the x quadrature; Vj^ is the output variance 
of the mode B in the p quadrature, which is measured at the 
remote side, and Cp is the correlation between trusted modes 
in the p quadrature, being unknown due to the fact that the 
quadrature is not modulated, which means that the channel 
transmittance is not estimated in p. 

The covariance matrix of the state, conditioned by Bob’s 
measurement in x is given by 

lAlxB =1A- a (5) 


with vertex (Vg®, Cq), defined as: 


V^ — 
^0 — 


1 + Vxf^x 


and 


Vq^Vvx^ 
(1 -I- Vm)3 


( 12 ) 


(13) 


The first part of the Holevo quantity, S{AB), can be calcu¬ 
lated from the symplectic eigenvalues Ai _2 that are given by 
the square roots of the solutions of equation 


where 7 ^, 7 b are the submatrices of the covariance matrix 
i'ab ®’ describing the modes A and B individually; aAB is 
the submatrix of (IHi, which characterizes correlation between 
modes A and B; MP stands for Moore Penrose (pseudo-) in¬ 
verse of a matrix, and 


X = 



( 6 ) 


In the general case the conditional matrix is thus given by 


7A|xb 


{Vm ) 

0 


0 

Vl + Vm 


(7) 


Now let us estimate the lower bound on the key rate O for 
our single quadrature protocol. Shannon mutual information 
between the trusted parties is easily calculated from the first 
diagonal elements of the matrices 7 ^ and 7 a|xb- 


Iab 



Va 

Va\b 



(l + JkVL.) 

\ 1 + Px£x / 


( 8 ) 


On the other hand, the estimation of the Holevo quantity 
Xbe, representing the upper bound on information, avail¬ 
able to an eavesdropper, should be done from the whole state 


z'^ — Az + det 'Jab = 0, (14) 

where A = det 7 a + det 7 b + 2 det ctab is the second sym¬ 
plectic invariant, the first one being det x'ab- The second part, 
S{A\xb), is calculated from Acond = yJdeX^A\xB- This al¬ 
lows one to analytically derive the lower bound on the key 
rate and find the security bounds in terms of the unknown cor¬ 
relation Cp upon given (measured) V^. 

The corresponding physicality region and security within 
physicality in terms of the correlation Cp are given in Fig. |2l 

It is evident from the graph, that there exists a region of 
lA®, when the protocol is secure for any Cp. In this region the 
UD protocol can be indeed implemented without the necessity 
of the correlation estimation in p, since no physically valid 
collective attack can break the security. For higher values of 
Vp® the protocol cannot be implemented, since it would only 
be secure for some values of Cp, but Alice and Bob cannot 
estimate the latter quantity. Such a behavior can be clearly 
observed at the graphs in Fig. 0 where dependence of the 
lower bound on the key rate on the correlation Cp is given for 
different values of V^^, corresponding to the respective lines 
in Fig. 121 

When the channel excess noise ea: > 0 increases, the phys¬ 
icality region of the state after the channel expands, which 
allows Fve to perform stronger attacks. 
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FIG. 2: Physicality (solid line) and security within the physicality 
(dashed line) regions of the UD protocol. The pessimistic value of 
Cp, which minimizes the key rate, is given as a bold solid line. Mod¬ 
ulation variance Vm = 10, channel transmittance in x, = 0.1, 
noise in x, tx = 5% SNR. Point A — {Co, V(P) denotes the vertex 
of the parabola, described by GD- The lines 1, 2, and 3 correspond 
to the key rate dependencies given in Fig. 


([n]i. 

As the noise increases, the pessimistic value of Cp gets 
lower than and must be found numerically. We thus 

consider the security region of our protocol as laying along 
the pessimistic value of Cp (given as a bold line in Fig. |2]i 
from Co to where physicality and security regions 

cross. In this case, a key rate computed at C™^^ is greater 
than the lower bound on the real key rate and is therefore too 
optimistic. However, when the pessimistic value of Cp is in¬ 
side the parabola, the dK/dCp = 0 at this point and the pes¬ 
simistic value is usually close to This explains why this 

upper bound, computed below, is often a good approximation. 

The parabola bounding the physicality region corresponds 
to a state saturating the Heisenberg inequality (|9l). There¬ 
fore, one of the symplectic eigenvalues A 2 = 1 and Ai = 
a/ det 7 ^^ and Eq. (I2]i becomes 

XBE -c{^\^det-iA\xB " ( 15 ) 


K 



FIG. 3: Key rate secure against collective attacks versus correlation 
Cp for different values of variance , corresponding to the lines 
1, 2, and 3 in Fig. [2l The rest of the channel parameters are the 
same as in the mentioned figure. Inset demonstrates the dependence 
of line 2 in the smaller scale. For comparison the line corresponding 
to = 1.00535 is given as dashed, demonstrating the particular 
case when security is lost and then restored. 


when Cp = 

When Vm ^ 1, i.e., in the strong-modulation limit, 
det 7 ^^ 1 and one can use the expansion of the bosonic 

function G (i(A — 1)) = log A -F log | + O (^), to 

derive the following expression for the key rate upper bound; 


Kvm^oo < 7 log 


r)x 


c 


l — ^rix+rixV^ +r]xtx+2VD 

(i<\/ 


-logf (16) 


r]x 




with D = r]x{l + r]x€x - r]x){Vf{l + - 1), (17) 


where < can be replaced by ~ when C™’^^ is indeed the worst 
Cp. If, furthermore, we are in the strong loss limit, where 
rjx I ll^ and Vj^ is close to 1 , one can expand the remain¬ 
ing bosonic function and obtain 


>-oo 


< 


T + 


i-Kf 




-Vd 


loge+0(?7^ 


(18) 

In the following Section we analyze the security of the UD 
protocol in the typical phase-insensitive Gaussian channels. 


C. Worst-Case Cp and Key Rate 


Counter-intuitively, the key rate is not always a 
monotonously decreasing function of the correlation 
\Cp\. Indeed, it can be seen from Fig. |3]that upon certain 
values of variance the lower bound on the key rate can 
have a local minimum within the security region. Moreover, 
the security can be even lost and restored (see the dashed line 
at the inset in Fig. O. 

However, when the channel excess noise added in p- 
quadrature is small (i.e., when is close to 1 ), the key rate is 
a monotonously decreasing function of the correlation \ Cp\ (as 
can be also seen in Fig. |2l in most of the physicality region, 
and the pessimistic value for Cp is typically the highest phys¬ 
ically valid negative value G™“, which saturates inequality 


IV. PERFORMANCE FOR SYMMETRIC QUANTUM 
CHANNELS 


In typical communication channels, one expects values of 
loss and excess noise in both quadratures to be symmetric. 
In this regime, px = Vp = ^x = £p = e. and therefore, 
Vp® = 1 -F pe. The previous equations then become 


<^log- 








with D = 277^e(l -F pe — ? 7)(1 + 
KT.^^ <{\- log e + 0{Tf + 






(19) 

( 20 ) 
( 21 ) 
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Note that Eqs. (fT9]l- (l2n i describe well the lower bound on 
the key rate if the losses or noise in the channel are low, i.e., 
r] ^ 1 or e —i> 0 , otherwise they give the result exceeding the 
lower bound on the key rate, and the latter needs to be calcu¬ 
lated numerically using the pessimistic Cp within the physi- 
cality region. 

We now compare the UD CV QKD protocol with the stan¬ 
dard symmetrical modulation protocol GG 02 ifTTl [l^ 1^ 1^ 
used over the same channel. We first assume a noiseless lossy 
channel, where e = 0 . 

In this case, Eq. (fTTT i becomes Cp = Cq and Eq. ( fTSl l 
gives therefore the key rate for our protocol. It becomes, for 

Vm oo 

Its low transmission limit rate is ^ log e, slightly smaller than 
the key rate of the standard coherent-state protocol in the high 
modulation limit, given by 0 

log (1 - p) ~ I log e for 77 « 1. (23) 

In the general case, however, the channel noise is present 
and reduces the security of the protocol. The results of the cal¬ 
culations in this case are given in Eig. |4]in terms of the lower 
bound on the key rate upon fixed channel excess noise and 
in Eig. |5]in terms of the maximum tolerable channel excess 
noise versus channel loss upon strong modulation Vm = 100 . 
Evidently, the UD protocol demonstrates higher sensitivity to 
channel excess noise, which is the cost of technical simpli¬ 
fication, but still provides the reasonable security region in 
terms of channel excess noise, even in the pessimistic assump¬ 
tion of the strongest physically possible collective attack. We 
also provide comparison with the case when the worst-case 
Cp is not estimated numerically but is optimistically taken as 
a bound to physicality C^°'^ (so that the key rate is approx¬ 
imately given by (l2TI) in the limit of strong modulation), the 
respective curve is given as the dot-dashed line in Eig. |3 It 
is evident from the plot that the optimistic assumption of the 
physicality-bounded gives the same security bounds as 
the pessimistic one when the channel attenuation goes below 
few dB. In this regime it is sufficient to bound security by the 
physicality condition. 

Zhao et al. have also introduced a single-modulation proto¬ 
col, ZHRL09. Contrary to our independently developed pro¬ 
tocol, it uses a binary modulation, simplifying even more the 
protocol implementation. However, its sensitivity to excess 
noise is orders of magnitude below the tolerable excess noise 
of the protocol presented here: An excess noise as small as 
e = 3 X 10“^ does not allow any positive key rate beyond 
1 dB losses, and e ~ 10“^ does not allow one to go beyond 
4 dB losses. This extreme sensitivity renders ZHRL09 use¬ 
less in practice. In their conclusion, Zhao et al. attribute this 
sensitivity to the binary modulation and predict that a Gaus¬ 
sian modulation would solve this problem. The present paper 
indeed proves this conjecture. 

Eor the sake of comparison we also analyzed the protocol, 
in which no information is extracted from the p quadrature. 


K 



FIG. 4: Typical dependence of the key rate on loss (in dB scale) upon 
symmetric channel excess noise e = 5% SNU. (Solid line) Symmet¬ 
rical coherent-state protocol; (dashed line) UD protocol with corre¬ 
lation estimation in p; (dotted line) UD protocol without correlation 
estimation in p. Modulation variance Vm = 100. 
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FIG. 5: Typical profile of the security region in terms of maximal 
tolerable channel excess noise e versus channel loss (in dB scale). 
(Solid line) Symmetrical coherent-state protocol; (dashed line) UD 
protocol with channel estimation in p; dotted line: UD protocol 
without channel estimation in p; (dot-dashed line) optimistic eval¬ 
uation of UD protocol without channel estimation in p assuming 
Cp = . Modulation variance Vm ~ 100. 


but some modulation and measurement is performed to esti¬ 
mate the channel transmittance (and, equivalently, the correla¬ 
tion) in p. This intermediate protocol provides the security re¬ 
gion, which lays in between the symmetrical and completely 
asymmetrical counterparts, but requires modulation in both 
quadratures. Its main interest it theoretical, since it allows one 
to split the origin of the performance degradation of our pro¬ 
tocol compared to GG02 between the degradation due to the 
asymmetric modulation and the one due to incomplete chan¬ 
nel estimation. 

Another possible option to improve the UD protocol could 
be the noise addition in p to decouple the eavesdropper from 
the remote trusted party. However, it widens the physicality 
region, allowing for the stronger collective attacks, and thus, 
if the noise is strong enough, security is always broken be¬ 
fore the physicality bound, meaning that additional noise in 
p makes the protocol inapplicable. Additionally, if the chan¬ 
nel estimation in p is performed, then the protocol shows the 
sa me p erformance as the standard squeezed-based protocol 

[iJ, 1^ [SOl, since the homodyne detection on A projects 
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the two-mode state on the single-mode squeezed state, getting 
more squeezed as the noise in p increases. 

Further analysis of the protocol will include consideration 
of reduced post-processing efficiency 11^ . composable se¬ 
curity and finite-size effects |24|] . which, however, 
depend on the signal-to-noise ratio and number of samples, 
rather than the Gaussian modulation profile and thus would 
affect the symmetrical and asymmetrical protocols similarly. 
The position of the pessimistic bound for the unmeasured 
correlation in p in particular does not depend on the post¬ 
processing efficiency. 

V. SUMMARY AND CONCLUSIONS 

We have proposed and investigated the unidimensional 
continuous-variable quantum key distribution protocol based 
on the Gaussian modulation of a single quadrature of coher¬ 
ent states of light, in which physicality bounds enable to limit 
the eavesdropping attacks and assess the security region. The 
protocol allows simpler technical realization with no need of 


phase quadrature modulation and full channel estimation at 
the cost of lower key rate and higher sensitivity to channel ex¬ 
cess noise, compared to the symmetrical coherent-state proto¬ 
col. However, the performance of the protocol is still compa¬ 
rable to that of the symmetrical counterpart and allows for the 
practical implementation. 

Acknowledgments 

We thank Eleni Diamanti, Paul Jouguet, and Christoph 
Marquardt for the discussion on the experimental interest of 
the proposed protocol. We also thank Anthony Leverrier for 
drawing our attention to the work of Zhao et al. The work of 
VCU was supported by Project No. P205/10/P32 of the Czech 
Science Foundation, by the European Union FP7 Project No. 
BRISQ2 under Grant Agreement No. 308803, co-financed 
by MSMTCR (7E13032), and by the NATO SPS Project No. 
984397. Thework of EG was supported by the French Agence 
Nationale de la Recherche FReQueNCy project (Project No. 
ANR-09-BLAN-0410-02). 


[1] V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Dusek, N. 
Liitkenhaus, and M. Peev, Rev. Mod. Phys. 81 , 1301 (2009). 

[2] C. Weedbrook, S. Pirandola, R. Garcia-Patron, N. J. Cerf, T. C. 
Ralph, J. H. Shapiro, and S. Lloyd, Rev. Mod. Phys. 84, 621 
( 2012 ). 

[3] T. C. Ralph, Phys. Rev. A 61, 010303(R) (1999). 

[4] M. Hillery, Phys. Rev. A 61 , 022309 (2000). 

[5] D. Gottesman and J. Preskill, Phys. Rev. A 63 , 022309 (2001). 

[6] N.J. Cerf, M. Levy, and G. Van Assche, Phys. Rev. A 63, 
052311 (2001). 

[7] F. Furrer, T. Franz, M. Berta, A. Leverrier, V. B. Scholz, M. 
Tomamichel, and R. F. Werner, Phys. Rev. Lett. 109 , 100502 
( 2012 ). 

[8] F. Furrer, Phys. Rev. A 90 , 042325 (2014). 

[9] L. S. Madsen, V. C. Usenko, M. Lassen, R. Filip, and U. L. 
Andersen, Nature Communication 3, 1083 (2012). 

[10] T. Gehring, V. Handchen, J. Duhme, F. Furrer, T. Franz, C. 
Pacher, R. F. Werner, and R. Schnabel, Nature Communications 
6, 8795 (2015). 

[11] F. Grosshans and Ph. Grangier, Phys. Rev. Lett. 88, 057902 

( 2002 ). 

[12] F. Grosshans and Ph. Grangier, Proceedings of the 6th Inter¬ 
national Conference on Quantum Communications, Measure¬ 
ment, and Computing, arXiv:quant-ph/0204127 (2002). 

[13] Ch. Silberhom, T. C. Ralph, N. Liitkenhaus and G. Leuchs, 
Phys. Rev. Lett. 89 , 167901 (2002). 

[14] F. Grosshans, G. Van Assche, J. Wenger, R. Brouri, N. J. Cerf, 
and Ph. Grangier, Nature (London) 421, 238 (2003). 

[15] C. Weedbrook, A. M. Lance, W. P. Bowen, T. Symul, T. C. 
Ralph, and P. K. Lam, Phys. Rev. Lett. 93, 170504 (2004). 

[16] A. M. Lance, T. Symul, V. Sharma, C. Weedbrook, T. C. Ralph, 
and P. K. Lam, Phys. Rev. Lett. 95 , 180503 (2005). 

[17] P. Jouguet, S. Kunz-Jacques, A. Leverrier, Ph. Grangier, and E. 
Diamanti, Nature Photonics 7, 378 (2013). 

[18] P. Jouguet, D. Elkouss, and S. Kunz-Jacques, Phys. Rev. A 90 , 
042329 (2014). 


[19] Y.-B. Zhao, M. Held, J. Rigas, and N. Ltkenhaus Phys. Rev. A 
79 , 012307 (2009). 

[20] Paul Jouguet (private communication); 1. Khan, B. Stiller, N. 
Jain, P. Jouguet, S. Kunz-Jacques, E. Diamanti, C. Marquardt 
and G. Leuchs, Quantitative analysis of Trojan-horse attacks 
on practical continuous-variable quantum key distribution sys¬ 
tems, Poster 70 at the 5th International Conference on Quantum 
Cryptography, September 28 - October 2, 2015, Tokyo Japan. 

[21] J. L. Duligall, M. S. Godfrey, K. A. Harrison, W. J. Munro, and 
J. G. Rarity, New J. Phys. 8, 249 (2006). 

[22] H.-K. Lo, H. E. Chau, and M. Ardehali, J. of Cryptology, 18 , 
133 (2005). 

[23] A. Leverrier, E. Grosshans, and P. Grangier, Phys. Rev. A. 81 , 
062343 (2010). 

[24] L. Ruppert, V. C. Usenko, and R. Eilip, Phys. Rev. A 90 , 062310 
(2014). 

[25] R. Renner and J. 1. Cirac, Phys. Rev. Lett., 102 , 110504 (2009). 

[26] M. Christandl, R. Kdnig, and R. Renner, Phys. Rev. Lett. 102, 
020504 (2009). 

[27] A. Leverrier, R. Garcia-Patron, R. Renner, and N. J.Cerf, Phys. 
Rev. Lett. 110 030502 (2013). 

[28] A. Leverrier, Phys. Rev. Lett. 114 070501 (2015). 

[29] M. Navascues, F. Grosshans, and A. Acm, Phys. Rev. Lett. 97 , 
190502 (2006). 

[30] R. Garcia-Patron and N. J. Cerf, Phys. Rev. Lett. 97 , 190503 
(2006). 

[31] S. Pirandola, S. L. Braunstein, and S. Lloyd, Phys. Rev. Lett. 
101 , 200504 (2008). 

[32] M. M. Wolf, G. Giedke, and J. 1. Cirac, Phys. Rev. Lett. 96, 
080502 (2006). 

[33] A. S. Holevo, and N. R. F. Werner, Phys. Rev. A 63, 032312 

( 2001 ). 

[34] 1. Csiszar and J. Korner, IEEE Trans. Inf. Theory 24 , 339 
(1978). 

[35] 1. Devetak and A. Winter, Phys. Rev. Lett. 93, 080501 (2004). 

[36] The basis of the logarithm used to compute entropic quantities 



7 


(entropy, mutual and Holevo information, key rates), defines 
the unit used: base 2 for bits, base e for nats, base for 

decibans, etc. 

[37] A. Serafini, M. G. A. Paris, F. Illuminati, and S. De Siena, J. 
Opt. B, 7, R19 (2005). 

[38] F. Grosshans, N. J. Cerf, J.Wenger, R. Tualle-Brouri, and P. 
Grangier, Quantum Inf. Comput. 3, 535 (2003). 


[39] The order in which the limits Vm —>■ oo and rj^ ^ Q are taken 
is important and changes the result. In particular, the order taken 
here assumes VM^/rj 1. 

[40] F. Grosshans, Phys. Rev. Lett. 94, 020504 (2005). 

[41] G. van Assche. Quantum Cryptography and Secret-Key Distil¬ 
lation (Cambridge University Press, Cambridge, 2006). 


